This is probably a big part of why people don’t generally opt out of iOS upgrades: they’re basically just annual app upgrades packaged together (notwithstanding some pretty conspicuous Safari updates in recent point releases), anything OS level is mostly iteration on a mostly stable core and has been for almost a decade.

I do think they could and should be more aggressive with security updates. Both by releasing/messaging those separately from other kinds of point releases (improving but not great), and by notifying sooner/more frequently. It definitely irks me when I find out about a critical security patch over a week after it was available, and that the security content is a secondary link with no immediate conveyance of its urgency. And they should also make it a lot more obvious how to go find out if an update is even available in the first place.

Even today(?)’s rapid response, I had to read about it on some site and then remember the incantation to go look to see if the update was available. Of course it was, so I tapped download and install. After waiting a while, I switched to another thing. When I came back, it was downloaded and ready and waiting for another affirmative to do the thing I already requested. I should not need to do any of this when I have automatic updates on.